data retrieval

Request a patient's health information

Also known as: HIU Health Information Request. Requests health data from the HIP for a specific consent artefact.

MandatoryAny one of them is mandatory

Certification cases HIU_FLOW_101, HIU_FLOW_102, HIU_FLOW_103, HIU_FLOW_104, HIU_FLOW_105, HIU_FLOW_106, HIU_FLOW_107, HIU_FLOW_108, HIU_FLOW_109, HIU_FLOW_110, HIU_FLOW_111, HIU_FLOW_112, HIU_FLOW_113

POST/hiecm/data-flow/v3/health-information/request

The HIU must: 1. Generate an ECDH key pair before this call 2. Pass the ECDH public key in keyMaterial.dhPublicKey 3. Expose a dataPushUrl endpoint that can receive encrypted FHIR data from the HIP

The HIP encrypts data using the HIU's public key (ECDH shared secret) and pushes it to dataPushUrl. The HIU decrypts using its private key + HIP's public key from the push request's keyMaterial.

Supported ECDH curves: Curve25519 Supported crypto algorithms: ECDH

Authorizations

Authorizationbearer tokenRequired

Bearer token obtained from POST /hiecm/gateway/v3/sessions

Headers

REQUEST-IDstringRequired

A fresh UUID that you generate for this request. The callback that answers it carries the same value. In M3 a single consent can produce several callbacks, so keep the mapping from request id to consent request id rather than relying on ordering.

TIMESTAMPstringRequired

The current time in ISO 8601 UTC, with milliseconds and the Z suffix. The gateway rejects a request whose timestamp has drifted too far from its own clock, so take this from a synchronised clock rather than from a local one.

X-CM-IDstringRequired

Which consent manager you are talking to. sbx on the sandbox and abdm in production.

X-HIU-IDstringRequired

Identifier of the health information user the request or callback is intended for. This is per facility, and it is what a callback arriving at your one bridge URL is routed on. The bridge URL and your credentials belong to the integration, not to the facility.

Body

hiRequestobjectRequired

hiRequest.consentobjectRequired

hiRequest.consent.idstringRequired

Consent artefact ID from the granted consent

hiRequest.dateRangeobjectRequired

hiRequest.dateRange.fromstringRequired

Must be within the consent's permitted date range

hiRequest.dateRange.tostringRequired

hiRequest.dataPushUrlstringRequired

HTTPS endpoint on the HIU server to receive encrypted FHIR data

hiRequest.keyMaterialobjectRequired

Responses

202

Health information request accepted

The callback never arrives

400

Bad request, invalid parameters or missing fields

Error codes for this module

401

Unauthorized, missing or invalid Bearer token

Everything returns 401

Request a patient's health information

curl --request POST \
  --url https://dev.abdm.gov.in/api/hiecm/data-flow/v3/health-information/request \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'REQUEST-ID: 5f7a4a1e-59ba-4c0c-9e0c-8e6b3b6e2f11' \
  --header 'TIMESTAMP: 2026-08-25T15:51:15.339Z' \
  --header 'X-CM-ID: <X_CM_ID>' \
  --header 'X-HIU-ID: IN2810014366' \
  --header 'Content-Type: application/json' \
  --data '{
  "hiRequest": {
    "consent": {
      "id": "consent-art-uuid-001"
    },
    "dateRange": {
      "from": "2023-01-01T00:00:00.000Z",
      "to": "2024-01-01T00:00:00.000Z"
    },
    "dataPushUrl": "https://your-hiu-server.com/abdm/data/push",
    "keyMaterial": {
      "cryptoAlg": "ECDH",
      "curve": "Curve25519",
      "dhPublicKey": {
        "expiry": "2024-12-31T00:00:00.000Z",
        "parameters": "Curve25519/32byte",
        "keyValue": "base64-encoded-hiu-ecdh-public-key"
      },
      "nonce": "base64-encoded-random-nonce-32bytes"
    }
  }
}'

{
  "transactionId": "<TRANSACTION_ID>"
}

Generated from the schema. The values are placeholders, not a captured response.

Callbacks

After this call, ABDM posts Acknowledgement of a health information request to /api/v3/hiu/health-information/on-request. Open the callback.

Request a patient's health information

Authorizations

Headers

Body

Responses

Callbacks​

Callbacks